v0.2.2 — signing flow migrated to Docker Hub

Completes the GHCR → Docker Hub migration started in v0.2.1. The platform-side (workflow + DOCKERHUB.md) shipped earlier today with kvendra-platform v0.1.0-alpha.0 signed release. This patch closes the reference-stack side.

Changes

• scripts/verify.sh: KVENDRA_IMAGES[] target switched from ghcr.io/kvendraai/kvendra-platform:0.1.0-alpha.0 to docker.io/kvendra/kvendra-platform:0.1.0-alpha.0. The cosign --certificate-identity-regexp is unchanged (still ^https://github\.com/KvendraAI/) because the OIDC identity that signs is GitHub Actions — the registry the image lives in is orthogonal to the signing identity.
• docs/signing.md: 4 ghcr.io references updated to docker.io (manual verify IMG, trust-chain diagram, cosign download attestation, release pipeline description). The maintainers section now documents the DOCKERHUB_USERNAME + DOCKERHUB_TOKEN secrets needed for the push leg.

Verified end-to-end

$ cosign verify docker.io/kvendra/kvendra-platform:0.1.0-alpha.0 \
    --certificate-identity-regexp '^https://github.com/KvendraAI/kvendra-platform/' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com
✓ cosign claims validated
✓ Rekor transparency log verified
✓ Fulcio cert chain valid

Image digest: sha256:10f76875aea6712ed6e5b36f0ae55fb6886ed1264f5a712ec138ac2e40448a69.
SBOM (SPDX JSON) attached as a cosign attestation + as an asset on the kvendra-platform v0.1.0-alpha.0 release.

Closes

• ISSUE-KVD-REFERENCESTACK-E17E41 (signing migration GHCR → Docker Hub).

Self-hosted user flow now (complete)

git clone https://github.com/KvendraAI/kvendra-reference-stack
cd kvendra-reference-stack
cp .env.example .env
# Edit .env — paste your Kvendra API key (signup at https://kvendra.cloud)
./scripts/verify.sh    # cosign verify before pull
./scripts/up.sh        # 3 containers (db + platform + backup)

v0.2.1 — Platform image migrated to Docker Hub

Summary

The kvendra-platform image is now distributed via Docker Hub (public, anonymous pull). Closes the "docker run y listo" gap that was deferred from v0.2.0 — a self-hosted user following Path A can now docker compose pull without GitHub auth.

Changes

• docker-compose.yml: image source ghcr.io/kvendraai/kvendra-platform → kvendra/kvendra-platform.
• README.md: Path B paragraph references the upstream Docker Hub image.
• scripts/build-from-source.sh: comments generalized (no longer ghcr.io-specific).

Distribution verified

$ docker pull kvendra/kvendra-platform:0.1.0-alpha.0
0.1.0-alpha.0: Pulling from kvendra/kvendra-platform
Digest: sha256:517ae7255d1e5693735c84c5fb1c25bae9a0874d2c954cd090b8574e85936b40
Status: Image is up to date for kvendra/kvendra-platform:0.1.0-alpha.0

• Docker Hub: https://hub.docker.com/r/kvendra/kvendra-platform (public, is_private:False).
• Image size: 194 MB (Node 20 Alpine, multi-stage build).
• Tags: 0.1.0-alpha.0, latest.

Self-hosted flow (post-v0.2.1)

git clone https://github.com/KvendraAI/kvendra-reference-stack
cd kvendra-reference-stack
cp .env.example .env
# Edit .env — paste your Kvendra API key (signup at https://kvendra.cloud)
./scripts/up.sh
# Stack is up: 3 containers (db + platform + backup), no GitHub auth, no 5 GB Ollama pull.

For LLM-local (no Kvendra signup): ./scripts/up.sh --with-ollama.

Unchanged (separate follow-up)

scripts/verify.sh and docs/signing.md still reference GHCR — the entire cosign keyless-OIDC flow is built around GHCR. Migrating signing to Docker Hub or supporting both registries is a dedicated refactor.

Trazabilidad

• Closes self-hosted "docker run y listo" gap (Vector C from TXN-KVD-20260527-001, deferred at that time).
• Related: PAT-KVD-4AF89B, REL-KVD-REFERENCESTACK-0.2.0.0.

v0.2.0 — Onboarding friction reduction

Summary

First tagged release of the Kvendra reference-stack. Reduces onboarding friction for self-hosted users by aligning with Claude Code as universal orchestrator (PAT-KVD-4AF89B) and making Ollama opt-in.

What changed

Vector A — Cleanup cline + Claude Code alignment

• docker-compose.yml: header comments reflect Claude Code as universal orchestrator (no cline).
• README.md: 5 sections rewritten — header, quick start, what's NOT in stack, modes heading, contributing. Zero productive cline / npx skills refs.
• docs/troubleshooting.md: cline_mcp_settings.json snippet replaced by claude mcp add block.
• docs/tier-a-b-c.md renamed to docs/modes.md and rewritten as a 3-modes table (Cloud default / Ollama opt-in / Mock CI).
• docs/lab-notes-free-tier-2026-05-22.md: preservation note header (historical content preserved verbatim).
• LICENSE: URL drift github.com/KvendraAI/skills → KvendraAI/kvendra-skills fixed.

Vector B — Default cloud embeddings + Ollama opt-in profile

• docker-compose.yml: EMBEDDINGS_PROVIDER default = openai-compatible pointing to https://api.kvendra.cloud/v1 with EMBEDDINGS_API_KEY=REPLACE_WITH_YOUR_KVENDRA_KEY placeholder.
• docker-compose.yml: kvendra-ollama service gated by profiles: [ollama]. Default docker compose up starts 3 containers (db + platform + backup, no Ollama, no 5 GB pull). docker compose --profile ollama up adds Ollama.
• .env.example: rewritten with cloud-default + 2 commented alternative blocks (Ollama local / mock CI). BACKUP_CRON quoted to fix bash 3.2 source. Drift api.kvendra.com → api.kvendra.cloud corrected.
• scripts/up.sh: new --with-ollama / --help flags. Post-up banner detects API key placeholder and prints signup instructions + Ollama alternative.
• scripts/smoke-cloud.sh (NEW, chmod 0755): wire-validate against api.kvendra.cloud/v1/embeddings. Exit 3 on placeholder, verifies dim=1024 response.

Outcome

Minimum self-hosted flow:

1. git clone + cp .env.example .env.
2. Sign up at https://kvendra.cloud → grab free-tier API key (200k tok/month).
3. Paste key in .env.
4. ./scripts/up.sh.
5. Install Claude Code + claude mcp add kvendra-platform http://localhost:7777/mcp -H "Authorization: Bearer <token>".
6. claude plugins install kvendra-skills.

Prefer no signup? ./scripts/up.sh --with-ollama (5 GB models, fully local).

Breaking changes

None. Users with an existing .env (e.g. EMBEDDINGS_PROVIDER=mock) keep their setting — defaults only apply to fresh .env copies from .env.example.

Stats

• 10 files changed, +410 / −209.
• 1 rename (tier-a-b-c.md → modes.md).
• 1 new file (scripts/smoke-cloud.sh).
• Closes ISSUE-KVD-REFERENCESTACK-35D1DE (cline cleanup) and ISSUE-KVD-WEB-DB033A (/install page update).
• Materializes PAT-KVD-4AF89B (single skill set, Claude Code as universal orchestrator).